In contrast to the proposed patch I preferred to prevent future issues as well
by improving the function get_user_attribute itself.
However, thanks to mbunkus for testing hash refresh better than me before.

The filter implementation of Trac's query module was used as a guide.
We won't care for banned accounts by default, just active ones and these
marked as pending for approval, on registration time and via the email
verification process, if enabled.

This could help a bit with rendering performance of the user admin panel too,
i.e. if you accumulate many banned accounts over time.